UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    CVE-2026-116750 · Vikrentcar (WordPress plugin)

    VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute

    Published 28 Oct 2026 · CVE Program
  2. Critical 9.8

    CVE-2026-109218 · Contact Manager (WordPress plugin)

    Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

    Published 28 Oct 2026 · CVE Program
  3. Medium 6.4

    CVE-2026-109370 · Document Emberdder (WordPress plugin)

    Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

    Published 28 Oct 2026 · CVE Program
  4. Medium 6.4

    CVE-2026-77871 · Post Snippets (WordPress plugin)

    Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    Published 28 Oct 2026 · CVE Program
  5. Medium 6.4

    CVE-2026-107710 · Wordpress Popup (WordPress plugin)

    Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

    Published 28 Oct 2026 · CVE Program
  6. Medium 4.4

    CVE-2026-109988 · Woo Custom Product Addons (WordPress plugin)

    Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter

    Published 28 Oct 2026 · CVE Program
  7. Medium 5.3

    CVE-2026-2839 · Acf Extended (WordPress plugin)

    Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints

    Published 28 Oct 2026 · CVE Program
  8. Medium 5.4

    CVE-2026-116761 · Cmb2 (WordPress plugin)

    CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form

    Published 28 Oct 2026 · CVE Program
  9. Medium 6.4

    CVE-2026-108366 · Easyjobs (WordPress plugin)

    easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute

    Published 28 Oct 2026 · CVE Program
  10. Medium 6.4

    CVE-2026-110071 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  11. High 7.2

    CVE-2026-111111 · Bdthemes Prime Slider Lite (WordPress plugin)

    Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape

    Published 28 Oct 2026 · CVE Program
  12. Medium 4.3

    CVE-2026-111213 · Tour Booking Manager (WordPress plugin)

    Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter

    Published 28 Oct 2026 · CVE Program
  13. Medium 4.3

    CVE-2026-116610 · Clean Login (WordPress plugin)

    Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook

    Published 28 Oct 2026 · CVE Program
  14. Medium 6.4

    CVE-2026-116749 · Vikrentcar (WordPress plugin)

    VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute

    Published 28 Oct 2026 · CVE Program
  15. Medium 6.1

    CVE-2026-92098 · Contact Form 7 Multi Step Module (WordPress plugin)

    Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter

    Published 28 Oct 2026 · CVE Program
  16. Medium 4.3

    CVE-2026-109980 · Related Posts For WP (WordPress plugin)

    Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter

    Published 28 Oct 2026 · CVE Program
  17. Medium 6.4

    CVE-2026-118164 · If So (WordPress plugin)

    If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter

    Published 28 Oct 2026 · CVE Program
  18. Medium 5.4

    CVE-2026-100175 · Postie (WordPress plugin)

    Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink

    Published 28 Oct 2026 · CVE Program
  19. High 8.8

    CVE-2026-109384 · Ivyforms (WordPress plugin)

    The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload

    Published 28 Oct 2026 · CVE Program
  20. Medium 6.4

    CVE-2026-77188 · Waitlist Woocommerce (WordPress plugin)

    Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-110020 · Widget Google Reviews (WordPress plugin)

    Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page

    Published 28 Oct 2026 · CVE Program
  22. Medium 4.3

    CVE-2026-109979 · Related Posts For WP (WordPress plugin)

    Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter

    Published 28 Oct 2026 · CVE Program
  23. High 8.8

    CVE-2026-111120 · Vikrentcar (WordPress plugin)

    VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task

    Published 28 Oct 2026 · CVE Program
  24. Medium 6.4

    CVE-2026-104740 · If So (WordPress plugin)

    If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  25. Medium 4.3

    CVE-2026-111372 · Woowbot Woocommerce Chatbot (WordPress plugin)

    AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action

    Published 28 Oct 2026 · CVE Program
  26. Medium 6.4

    CVE-2026-109978 · Cozy Addons (WordPress plugin)

    Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute

    Published 28 Oct 2026 · CVE Program
  27. Medium 5.3

    CVE-2026-76058 · Paypal Brasil Para Woocommerce (WordPress plugin)

    PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action

    Published 28 Oct 2026 · CVE Program
  28. Medium 6.4

    CVE-2026-109972 · S2member (WordPress plugin)

    s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  29. Medium 4.4

    CVE-2026-111068 · Designsetgo (WordPress plugin)

    DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute

    Published 28 Oct 2026 · CVE Program
  30. Medium 6.4

    CVE-2026-109590 · Tour Booking Manager (WordPress plugin)

    Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes

    Published 28 Oct 2026 · CVE Program
  31. Medium 6.4

    CVE-2026-109385 · Uichemy (WordPress plugin)

    UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL

    Published 28 Oct 2026 · CVE Program
  32. Medium 6.4

    CVE-2026-103996 · If So (WordPress plugin)

    If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute

    Published 28 Oct 2026 · CVE Program
  33. High 7.2

    CVE-2026-110662 · Mxchat Basic (WordPress plugin)

    MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating

    Published 28 Oct 2026 · CVE Program
  34. High 7.2

    CVE-2026-109381 · Mage Eventpress (WordPress plugin)

    Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

    Published 28 Oct 2026 · CVE Program
  35. Medium 6.4

    CVE-2026-103370 · Awesome Support (WordPress plugin)

    Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion

    Published 28 Oct 2026 · CVE Program
  36. Medium 6.5

    CVE-2026-116609 · WP Stats Manager (WordPress plugin)

    WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  37. High 7.5

    CVE-2026-15323 · Lumise (WordPress plugin)

    Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload

    Published 28 Oct 2026 · CVE Program
  38. Medium 4.8

    CVE-2026-109236 · Customer Email Verification For Woocommerce (WordPress plugin)

    Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter

    Published 28 Oct 2026 · CVE Program
  39. Medium 6.4

    CVE-2026-111727 · Appointment Booking Calendar (WordPress plugin)

    Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter

    Published 28 Oct 2026 · CVE Program
  40. High 7.5

    CVE-2026-116613 · Animated Text Block (WordPress plugin)

    Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  41. High 7.5

    CVE-2026-111255 · Affiliate Toolkit Starter (WordPress plugin)

    affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

    Published 28 Oct 2026 · CVE Program
  42. Medium 4.2

    CVE-2026-107745 · AI Engine (WordPress plugin)

    AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

    Published 28 Oct 2026 · CVE Program
  43. Medium 6.4

    CVE-2026-109209 · All In One Video Gallery (WordPress plugin)

    All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

    Published 28 Oct 2026 · CVE Program
  44. High 7.2

    CVE-2026-111314 · Affiliate Toolkit Starter (WordPress plugin)

    affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter

    Published 28 Oct 2026 · CVE Program
  45. High 7.2

    CVE-2026-97019 · Accelerated Mobile Pages (WordPress plugin)

    AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  46. High 7.2

    CVE-2026-109999 · AI Marketing Expert (WordPress plugin)

    AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

    Published 28 Oct 2026 · CVE Program
  47. Medium 6.4

    CVE-2026-109974 · All In One Video Gallery (WordPress plugin)

    All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  48. Medium 6.4

    CVE-2026-107625 · Ultimate Member (WordPress plugin)

    Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field

    Published 28 Oct 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-106013 · Jupiterx Core (WordPress plugin)

    Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

    Published 28 Oct 2026 · CVE Program
  50. High 8.7

    CVE-2026-112355 · Memberfindme (WordPress plugin)

    MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API

    Published 27 Oct 2026 · Fixed in 6.17 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.